Office  of  the  Inspector  General 
Department  of  Defense 

DISTRIBUTION  STATEiyiEr-  A 
Approved  for  Public  Release 
Distribution  Unlimited 

20000321  090 

imC  QUALITY  mSPECTED  S 


Additional  Copies 

To  obtain  additional  copies  of  this  evaluation  report,  contact  the  Secondary  Reports 
Distribution  Unit  of  the  Analysis,  Planning,  and  Technical  Support  Directorate  at 
(703)  604-8937  (DSN  664-8937)  or  FAX  (703)  604-8932. 

Suggestions  for  Future  Audits  or  Evaluations 

To  suggest  ideas  for  or  to  request  future  audits  or  evaluations,  contact  the  Planning  and 
Coordnation  Branch  of  the  Analysis,  Planning,  and  Technical  Support  Directorate  at 
(703)604-8939  (DSN  664-8939)  or  FAX  (703)  604-8932.  Ideas  and  requests 
can  dso  be  mailed  to; 

OAIG-AUD  (ATTN;  APTS  Audit  Suggestions) 

Inspector  General,  Department  of  Defense 
400  Army  Navy  Drive  (Room  801) 

Arlington,  Virginia  22202-2884 

Defense  Hotline 

To  report  fraud,  waste,  or  abuse,  contact  the  Defense  Hotline  by  calling  (800)  424-9098; 
by  sentog  an  electronic  message  to  Hotline@DODIG.OSD.MIL;  or  by  writing  to  the 
Defense  Hotline,  The  Pentagon,  Washington,  D.C.  20301-1900.  The  identity  of  each 
writer  and  caller  is  fully  protected. _ 


Acronyms 

GAAS  Generally  Accepted  Auditing  Standards 

GAS  Government  Auditing  Standards 

0MB  Office  of  Management  and  Budget 

R&D  Research  and  Development 


INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON.  VIRGINIA  22202-2884 


September  15,  1997 


Kestrel  Institute 
Board  of  Trustees 
3260  Hillview  Avenue 
Palo  Alto,  California  94303 


Leonard  G.  Bimbaum  and  Company,  LLP 
1773  Woodside  Road,  Suite  210 
Redwood  City,  California  94061 


SUBJECT:  Quality  Control  Review  of  Leonard  G.  Bimbaum  and  Company,  LLP 
Kestrel  Institute 

Fiscal  Year  Bided  December  31,  1995 
Report  No.  PO97-042 


Introduction 

We  are  providing  this  report  for  your  information  and  response.  Your  Redwood  City, 
California,  office  performed  the  single  audit  for  the  Kestrel  Institute  (Kestrel),  Palo 
Alto,  California,  a  noi^rofit  organization  providing  scientific  research  and  graduate 
education  in  the  area  of  computer  science.  The  audit  is  required  by  Office  of 
Management  and  Budget  (0MB)  Circular  A-133,  "Audits  of  Institutions  of  Higher 
Education  and  Other  Nonprofit  Institutions."  For  the  fiscal  year  ended  December  31, 
1995,  Kestrel  reported  total  Federal  expenditures  of  $3,264,430.  Of  the  total  Federal 
expenditures,  $3,214,430  is  related  to  the  Department  of  Defense  and  $50,000  to  other 
Federal  agencies. 

Leonard  G.  Bimbaum  and  Company,  LLP,  issued  its  audit  report  March  8,  1996.  The 
auditors  questioned  no  costs  and  issued  an  unqualified  opinion  on  the  financial 
statements,  Schedule  of  Federal  awards,  and  compliance  with  specific  requirements 
applicable  to  major  programs.  The  auditors  issued  positive  and  negative  assurance 


with  respect  to  the  items  tested,  the  results  of  the  auditors’  procedures  disclosed  no 
material  instances  of  noncompliance.  Negative  assurance  states  that,  with  respect  to  the 
items  not  tested,  nothing  came  to  the  auditors’  attention  that  caused  them  to  believe  that 
an  institution  has  not  complied  in  all  material  respects.  The  auditors  also  obtained  an 
understanding  of  the  internal  controls  related  to  the  financial  statements  and  Federal 
awards.  The  audit  report  describes  the  auditor’s  scope  of  work  in  obtaining  that 
understanding  and  in  assessing  control  risk.  The  report  on  internal  controls  further 
describes  the  significant  internal  controls  and  control  structure  including  the  controls 
established  that  provide  reasonable  assurance  that  Federal  awards  are  being  managed  in 
compliance  with  applicable  laws  and  regulations. 


Quality  Control  Review  Results 

The  working  papers  supporting  the  0MB  Circular  A-133  audit  generally  met  the 
applicable  gui^ce  and  regulatory  requirements  in  the  Circular,  its  related  Compliance 
Supplement,  Government  Auditing  Standards  (GAS),  generally  accepted  auditing 
standards  (GAAS),  and  the  provisions  of  the  Federal  award  agreements.  See  the 
“Discussion  of  Findings”  section  later  in  this  report. 


Quality  Control  Review  Objective 

The  objective  of  a  quality  control  review  is  to  assure  that  the  audit  was  conducted  in 
accord^ce  with  applicable  standards  and  meets  the  auditing  requirements  of  0MB 
Circular  A-133.  As  the  oversight  agency  for  Kestrel,  the  Office  of  the  Inspector 
General,  DoD,  conducted  a  quality  control  review  of  the  audit  working  papers.  We 
focused  our  review  on  the  following  qualitative  aspects  of  the  audit:  due  professional 
care,  planning,  supervision,  independence,  quality  control,  internal  controls, 
substantive  testing,  general  and  specific  compliance  testing,  and  the  Schedule  of 
Federal  Awards. 

We  reviewed  the  most  recent  peer  review  letter  dated  June  8,  1995,  issued  by  Sorelle  & 
Associates  PC.  The  letter  states  that  Leonard  G.  Bimbaum  and  Company,  LLP,  met 
the  objectives  of  the  quality  control  review  standards  established  by  the  American 
Institute  of  Certified  Public  Accountants  and  that  the  standards  were  being  complied 
with  during  the  fiscal  year  ended  December  31,  1994.  However,  Sorelle  &  Associates 
PC  made  recommendations  for  improvement  in  two  areas  noted  in  the  previous  review. 
Specifically,  Sorelle  &  Associates  PC  recommended  that  Leonard  G.  Bimbaum  and 
Company,  LLP:  revise  its  quality  control  policies  and  procedures  to  require  an 
independent  review  of  all  audit  engagements  and  selected  reviews  and  compilations  and 
reemphasize  to  staff  the  importance  of  documenting  all  significant  auditing  procedures 
and  considerations. 
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Scope  and  Methodology 

We  used  the  1991  edition  of  the  Uniform  Quality  Control  Guide  for  Single  Audits  (the 
Guide)  that  was  approved  by  the  President’s  Council  on  Integrity  and  Efficiency  as 
guidance  for  performing  the  quality  control  review  procedures.  The  Guide  is  organized 
by  the  general  and  field  work  audit  standards  and  the  required  elements  of  a  single 
audit.  The  Guide  is  further  divided  into  the  substantive  work  performed  during  the 
audit  of  the  financial  statements  and  the  specific  program  compliance  testing  for  major 
programs.  In  addition,  we  supplemented  the  Guide  to  include  additional  review  of 
transaction  testing.  Our  review  was  conducted  from  May  5  through  9,  1997. 

We  limited  the  scope  of  our  quality  control  review  to  the  audit  working  papers  covering 
areas  related  to  the  Department  of  Defense  expenditures,  the  financial  statements  and 
the  research  and  development  (R&D)  program.  The  Federal  R&D  program 
expendimres  totaled  about  $3.3  million  and  accounted  for  100  percent  of  Federal  award 
expenditures  for  Kestrel. 


Results  of  Prior  Quality  Control  Reviews 

We  have  not  previously  conducted  a  quality  control  review  of  Leonard  G.  Bimbaum 
and  Company,  LLP. 


Background 

The  Inspector  General  Act  of  1978,  Public  Law  95-452,  prescribes  the  duties  and 
responsibilities  of  that  office.  In  implementing  those  responsibilities,  the  Inspector 
General  is  required  to  "take  appropriate  steps  to  assure  that  any  work  performed  by 
non-Federal  auditors  complies  with  the  standards  established  by  the  Comptroller 
General." 

The  Single  Audit  Act  of  1984  (Public  Law  98-502)  was  intended  to  improve  the 
financial  management  of  state  and  local  governments  whose  annual  expenditures  total 
$1(K),000  or  more  with  respect  to  Federal  financial  assistance  programs;  establish 
uniform  requirements  for  audits  of  Federal  financial  assistance;  promote  efficient  and 
effective  use  of  audit  resources;  and  ensure  that  Federal  departments  and  agencies  rely 
on  and  use  the  audit  work  done  under  the  Act,  to  the  maximum  extent  practicable. 

The  Single  Audit  Act  Amendments  of  1996,  based  on  12  years  of  experience  under  the 
1984  Act,  are  intended  to  strengthen  die  usefulness  of  single  audits  by  increasing  the 
audit  threshold  from  $100,000  to  $300,000  in  Federal  Financial  Assistance  before  an 
audit  is  required  under  the  Act;  selecting  programs  to  be  audited  based  on  risk  rather 
than  the  amount  of  funds  involved;  and  improving  the  contents  and  timeliness  of  single 
audit  reports.  The  Amendments  also  bring  nonprofit  organizations,  previously  covered 
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by  similar  requirements  under  the  0MB  Circular  A-133,  under  the  Single  Audit  Act 
provisions. 

The  0MB  Circular  A-133  establishes  the  Federal  audit  and  reporting  requirements  for 
nonprofit  and  educational  institutions  whose  Federal  awards  total  or  exceed  $100,000. 
The  Circular  provides  that  an  audit  made  in  accordance  with  the  Circular  shall  be  in 
lieu  of  any  financial  audit  required  under  individual  Federal  awards.  An  agency  must 
rely  on  the  audit  to  the  extent  that  it  provides  the  information  and  assurances  that  an 
agency  needs  to  implement  its  overall  responsibilities.  The  coordinated  audit  approach 
provides  for  the  independent  public  accountant,  Federal  auditor,  and  other  non-Federal 
auditors  to  consider  each  other's  work  in  determining  the  nature,  timing,  and  extent  of 
their  respective  audit  procedures.  The  Circular  also  requires  that  the  cognizant  agency 
obtain  or  conduct  quality  control  reviews  of  selected  audits  made  by  non-Federal 
auditors  and  provide  the  results,  when  appropriate,  to  other  interested  organizations. 
The  revised  Circular  was  issued  on  June  24,  1997,  to  incorporate  the  changes  in  the 
Single  Audit  Act  Amendments  of  1996.  Its  provisions  apply  to  audits  of  fiscal  years 
beginning  after  June  30,  1996. 


Discussion  of  Findings 

During  our  quality  control  review,  we  reviewed  and  took  exception  to  the  following. 

Auditor’s  Report  on  Compliance  With  Specific  Requirements  Applicable  to 
Nonmajor  Program  Transaction.  We  found  that  Leonard  G.  Bimbaum  and 
Company,  LLP,  issued  a  report  on  compliance  with  specific  requirements  tqiplicable  to 
nonmajor  program  transactions  stating  that  the  auditors  tested  certain  transactions 
applicable  to  certain  nonmajor  Federal  programs  for  compliance  with  specific 
requirements.  However,  there  were  no  nonmajor  programs  and,  therefore,  no 
nonmajor  program  transactions.  R&D  program  expenditures  accounted  for  KX)  percent 
of  the  Federal  Award  expenditures  for  Kestrel.  Issuing  a  report  on  matters  that  do  not 
exist  indicates  a  lack  of  due  care  in  conducting  the  audit. 


Other  Matters 

Engagement  Letter.  We  found  that  Leonard  G.  Bimbaum  and  Company,  LLP,  did 
not  have  a  formal  policy  that  discussed  the  0MB  Circular  A-133  requirements  of 
allowing  representatives  of  the  cognizant  agency  to  have  access  to  the  working  papers 
and  of  maintaining  the  Working  papers  for  at  least  3  years  after  the  date  of  the  report. 
The  0MB  Circular  A-133,  Attachment,  paragraph  17,  states  that  representatives  of  the 
cognizant  agency,  other  Government  audit  staff,  and  GAO  shall  have  access  to  the 
audit  working  papers  upon  request  and  that  the  working  papers  should  be  maintained 
for  at  least  3  years  after  the  date  of  the  audit  report  or  longer  if  requested  by  the 
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cognizant  agency,  other  Government  audit  staff,  and  GAO  shall  have  access  to  the 
audit  working  papers  upon  request  and  that  the  working  papers  should  be  maintained 
for  at  least  3  years  after  the  date  of  the  audit  report  or  longer  if  requested  by  the 
cognizant  agency.  Clarification  of  these  requirements  in  the  engagement  letter 
minimizes  confusion  and  helps  to  ensure  a  proper  understanding  of  the  responsibilities 
of  each  party.  Leonard  G.  Bimbaum  and  Company,  LLP,  subsequently  added  the 
requirements  to  its  engagement  letter  for  the  fiscal  year  ended  December  31,  1996. 
Therefore,  no  further  action  is  required. 

Management  Representations.  We  found  that  the  management  representation  letter 
did  not  contain  certain  representations  that  should  ordinarily  be  obtained  in  an 
organization-wide  audit.  Specifically,  the  management  representation  letter  did  not 
contain  the  following  representations. 

•  Management  has  monitored  subrecipients  to  determine  that  that  they  have 
expended  financial  assistance  in  accordance  with  applicable  laws  and 
regulations  and  have  met  the  requirements  of  Circular  A- 133  or  other 
applicable  Federal  audit  requirements. 

•  Management  has  taken  appropriate  corrective  action  on  a  timely  basis  after 
receipt  of  a  subrecipient’s  auditor’s  report  that  identifies  noncompliance  with 
Federal  laws  and  regulations. 

•  Management  has  considered  the  results  of  the  subrecipient’s  audit  and  made 
the  necessary  adjustments  to  the  entity’s  books  and  records. 

Statement  on  Auditing  Standard  No.  19,  “Client  Representations,”  paragraph  .04,  and 
Statement  of  Position  92-9,  “Audits  of  Not-for-Profit  Organizations  Receiving  Federal 
Awards,”  paragraph  6.84,  requires  the  auditor  to  obtain  certain  written  representations 
from  managftmftnt  as  part  of  an  audit  conducted  to  express  an  opinion  on  compliance 
with  requirements  that  have  a  material  effect  on  a  Federal  award  program.  Lack  of  the 
required  written  representations  constitute  a  limitation  on  the  scope  of  the  audit 
potentially  sufficient  to  require  a  qualified  opinion  or  disclaimer  of  opinion  on  an 
institution’s  compliance  with  Circular  A-133  requirements. 

Selection  of  the  Audit  Firm.  We  found  that  Kestrel  did  not  procure  its  Single  Audit 
in  accordance  with  0MB  Circular  A-133  requirements.  Specifically,  in  the  competition 
for  selection  of  the  audit  firm.  Kestrel  did  not  issue  a  request  for  proposals  to  solicit 
potentially  interested  public  accounting  firms,  or  provide  adequate  justification  for  the 
selection  of  the  audit  firm.  The  0MB  Circular  A-133,  Attachment,  paragraph  10, 
requires  institutions  to  follow  the  procurement  standards  prescribed  by  Circular  A- 
110,  paragraph  43,  “Uniform  Requirements  for  Grants  and  Agreements  with 
Institutions  of  Higher  Education,  Hospitals,  and  Other  Non-profit  Organization.” 
Solicitations  should  clearly  set  forth  all  requirements  that  the  accounting  firm  shall 
fulfill  in  order  for  the  proposal  to  be  evaluated  by  Kestrel.  The  selected  accounting 
firm’s  proposal  should  be  responsive  to  the  solicitation.  Kestrel’s  evaluation  of 
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proposals  should  be  documented  and  include  consideration  of  factors  such  as  the 
integrity  of  the  accounting  firm,  record  of  past  performance,  and,  financial  and 
technical  resources  as  well  as  price.  Because  Kestrel  did  not  establish  full  and  open 
competition  to  the  maximum  extent  practical  in  the  selection  of  the  audit  firm.  Kestrel 
had  no  assurance  of  a  fair  and  reasonable  price  for  the  audit  and  did  not  comply  with 
Federal  requirements  for  procurement  of  single  audits. 


Recommendatioiis  for  Corrective  Actions 

1.  We  recommend  that  Leonard  G.  Birnbaum  and  Company,  LLP,  purge  the 
“Auditor’s  Report  on  Compliance  With  Specific  Requirements  Applicable  to 
Nonmajor  Program  Transaction,”  and  resubmit  the  single  audit  report  to  our 
office  at  no  additional  cost  to  the  Government . 

2.  We  recommend  that  Kestrel  Institute  include  in  its  representation  letter 
matters  concerning  a  system  for  monitoring  subrecipients,  taking  corrective  action 
on  the  subrecipient’s  auditor’s  report,  and  consider  the  results  of  subrecipients’ 
audits  to  mflki*  necessary  adjustments  to  the  entity’s  books  and  records. 

3.  We  recommend  that  Kestrel  Institute  follow  the  requirements  of  Office  of 
Management  and  Budget  Circular  A-133,  Attachment,  paragraph  10,  in  obtaining 
goods  and  services,  particularly  in  procuring  audit  services. 


Discussion  of  Results 

miring  our  quality  control  review,  we  reviewed  and  took  no  exception  to  the  working 
papers  supporting  the  following  reports  and  schedules. 

Independent  Auditor’s  Report.  The  auditor  is  required  to  obtain  reasonable 
assurance  about  whether  the  financial  statements  are  free  of  material  misstatement.  We 
reviewed  the  audit  program  and  the  testing  of  evidential  matter  to  determine  whether 
testing  was  sufficient  based  on  assessment  of  control  risk  to  warrant  the  conclusions 
reached  and  whether  the  working  papers  supported  the  conclusions. 

The  auditor  is  also  required  to  subject  the  Schedule  of  Federal  Awards  to  the  auditing 
procedures  applicable  to  the  audit  of  the  financial  statement  and  to  ensure  that  founts 
are  fairly  stated  in  relation  to  the  basic  financial  statements.  Our  review  was  included 
in  the  steps  of  evaluation  of  the  audit  working  papers  related  to  the  auditors’  report  on 
the  financial  statements. 

The  recipient  is  responsible  for  creating  the  Schedule  of  Federal  Award  E3q)enditures. 
The  auditor  is  required  to  audit  the  information  in  the  Schedule  and  to  ensure  that  it 


6 


identities  major  programs  as  defined  by  0MB  Circular  A-133  and  total  expenditures  for 
each  program.  We  reviewed  the  audit  program  for  the  appropriate  procedures, 
reviewed  a  selected  number  of  footings/cross-footings,  and  traced  some  of  the  amounts 
to  the  Subsidiary  Ledger  and/or  Trial  Balance. 

Auditor’s  Report  on  the  Internal  Control  Structure.  The  auditor  is  required  to 
obtain  an  understanding  of  the  internal  control  structure  that  is  sufficient  to  plan  the 
audit  and  assess  control  risk  for  the  assertions  in  the  financial  statements.  We  reviewed 
the  audit  program  for  the  appropriate  procedures,  the  working  paper  documentation, 
and  the  substantive  testing  performed. 

The  auditor  is  also  required  to  obtain  an  imderstanding  of  the  internal  control  structure 
and  to  assess  control  risk  to  determine  whether  the  auditor  intends  to  place  reliance  on 
the  internal  control  structure.  The  auditor  must  perform  tests  of  controls  to  evaluate 
the  effectiveness  of  the  design  and  operation  of  the  policies  and  procedures  in 
preventing  or  detecting  material  noncompliance,  to  review  the  system  for  monitoring 
subrecipients  and  for  obtaining  and  acting  on  subrecipient  audit  reports,  and  to 
determine  whether  controls  are  effective  to  ensure  that  direct  and  indirect  costs  are 
calculated  and  billed  in  accordance  with  the  general  requirements  in  the  Compliance 
Supplement.  We  reviewed  the  audit  program  for  the  appropriate  procedures,  the 
working  paper  documentation,  and  the  test  of  controls  performed. 

Auditor’s  Report  on  Compliance  With  Laws,  Regulations,  Contracts,  and  Grants 
Based  on  an  Audit  of  Financial  Statements  Performed  in  Accordance  With 
Government  Auditing  Standards.  The  auditor  is  required  to  determine  whether  the 
recipient  has  complied  with  the  laws  and  regulations  that  may  have  a  direct  and 
material  effect  on  the  determination  of  financial  statement  amotmts.  We  reviewed  the 
audit  program  for  the  appropriate  procedures,  the  working  paper  documentation,  its 
support,  and  the  compliance  tests  performed. 

Auditor’s  Report  on  Compliance  With  the  General  Requirements  Applicable  to 
Federal  Awards  Programs.  The  auditor  is  required  to  determine  whether  the  recipient 
has  complied  with  the  laws  and  regulations  that  may  have  a  direct  and  material  effect 
on  any  of  its  major  Federal  programs.  General  requirements  are  those  that  could  have 
a  material  effect  on  the  recipient's  financial  statements  including  those  prepared  for 
Federal  programs.  The  auditors’  procedures  were  limited  to  those  prescribed  in  the 
0MB  Compliance  Supplement.  We  reviewed  the  audit  program  for  the  appropriate 
procedures,  compared  the  audit  program  steps  to  those  in  the  Compliance  Supplement 
to  sure  that  all  areas  were  audited,  reviewed  the  working  paper  documentation 
and  its  support,  reviewed  the  compliance  tests  performed,  and  reevaluated  selected 
compliance  items. 

Auditor’s  Report  on  Compliance  With  Specific  Requirements  Applicable  to  Major 
Programs.  The  auditor  is  required  to  determine  whether  the  recipient  has  complied 
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with  laws  and  regulations  that  may  have  a  direct  and  material  effect  on  its  major 
Federal  programs,  including  Types  of  Services  Allowed  or  Unallowed;  Eligibility; 
Matching,  Level  of  Effort,  and/or  Earmarking  Requirements;  Special  Reporting 
Requirements;  and  Special  Tests  and  Provisions.  We  reviewed  the  audit  program  for 
the  appropriate  procedures,  compared  the  audit  program  steps  to  those  in  the 
Compliance  Supplement  to  make  sure  that  all  areas  were  audited,  reviewed  the  working 
paper  documentation  and  its  support,  reviewed  the  compliance  tests  performed,  and 
reevaluated  selected  compliance  items. 


Comments 

Because,  this  report  contains  findings  and  recommendations,  written  comments  are 
required  withm  60  days  of  the  date  of  this  report.  We  appreciate  the  courtesies 
extended  during  the  review.  If  you  have  questions,  please  contact  Ms.  Barbara 
Smolenyak,  Program  Director,  at  (703)  604-8761  or  Mr.  Sunil  R.  Kadam  at 
(703)  604-8735.  See  the  Enclosure  for  the  report  distribution. 


Russell  A.  Rau 
Assistant  Inspector  General 
Policy  and  Oversight 


Enclosure 
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